CVE-2026-89706

Received Received - Intake

Reset Write Verifier in Linux Kernel NFS Server

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn->writeverf at request time and reports it to the client via CB_OFFLOAD after the worker kthread completes. When the post-copy vfs_fsync_range() or filemap_check_wb_err() in _nfsd_copy_file_range() reports an error, the worker correctly leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes wr_stable_how as NFS_UNSTABLE, but the server's write verifier is not rotated. A client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with COMMIT to make the copied data durable. With the verifier unchanged, COMMIT returns the same value the client just received via CB_OFFLOAD, and the client concludes the copy is durable -- silently dropping the data whose writeback in fact failed. This violates the UNSTABLE+COMMIT durability contract (RFC 7862 section 15.1, RFC 8881 section 18.32) and matches the bug just fixed in nfsd_vfs_write() and nfsd_commit(). Rotate nn->writeverf at the writeback-failure site. The async COPY worker has no svc_rqst, so commit_reset_write_verifier() is not available here; calling nfsd_reset_write_verifier() directly mirrors the trace-less reset already used by nfsd_file_check_write_error() for the same purpose. Filter out -EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since neither indicates a durable-storage failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89706

EUVD

EUVD-2026-76618

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the NFS (Network File System) daemon (nfsd) not properly resetting the write verifier when an asynchronous COPY operation fails during writeback. The write verifier is a mechanism to ensure data durability, and failing to reset it can lead the client to incorrectly assume data was successfully written when it was not.

Detection Guidance

This vulnerability affects the Linux kernel's NFS server implementation. Detection requires checking kernel logs for NFS-related errors during async COPY operations or verifying if the kernel version is vulnerable. Commands like 'dmesg | grep nfsd' or 'journalctl -u nfs-server' may show related errors. Confirm kernel version with 'uname -r' and compare against patched versions.

Impact Analysis

This vulnerability could cause data loss if a client relies on the NFS server's acknowledgment of a successful write operation, only to later discover the data was not durably stored. It violates the expected durability contract between client and server.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that includes the fix for this NFS async COPY vulnerability. If immediate patching is not possible, consider disabling NFS async COPY functionality as a temporary workaround by adjusting NFS server configurations.

Hi! I’m here to help you understand CVE-2026-89706. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70